Reporting channel for a watchdog organisation: protecting the source's identity
A watchdog organisation has no employee whistleblowers; it has sources. Former employees of companies, officials, residents. For them, exposure means losing a job or worse, and an email inbox records the sender's address, which is already too much.
The situation
The organisation takes signals from people outside its own structure: former employees of companies, residents, officials. For them, exposure means losing a job or worse. An email inbox records the sender's address, and that is already too much.
How it works
The reporting page stores no IP address, loads nothing from third parties and uses no tracking tools. The reporter returns to the case with a number and a PIN, with no account and no email. Attachments lose their metadata before anyone opens them.
- Anonymity
- E2E encryption
- Multiple channels
In this scenario 4
What the Act says in this situation
The Whistleblower Protection Act protects people who report breaches in a work-related context, including through public disclosure, if the conditions of Article 51 are met: an earlier report with no response within the deadline, or reasonable grounds to believe that the breach poses an imminent threat to the public interest or that a report to an authority would be ineffective. A watchdog organisation that receives such information is not itself a "legal entity" with a duty to run a procedure for these people, but it is the controller of their data and is responsible for its security.
If the foundation employs 50 or more people, it additionally has the ordinary duty to run a procedure for its own employees and volunteers. Both channels can run in one system as separate forms with separate permissions.
What to watch when implementing
- No technical traces. The reporting page cannot log the IP address, load fonts or scripts from external servers, or use analytics. Each of these elements is a record held by a third party that can be obtained with a legal demand.
- Attachment metadata. A photo of a document taken on a phone contains the device model, the time and often the location; a scan from an office carries the device name. Stripping must be automatic, before anyone sees the file.
- Returning to the conversation with no account and no email. The source comes back through a case number and PIN, from any device, and can answer questions weeks later.
- The key on the organisation's side. Content and identity encrypted with a key the vendor does not have. A demand directed at the vendor cannot end with the handover of something that cannot be read.
- An internal procedure setting out who in the organisation has access to cases and on what terms, with written authorisations, even though the Act does not expressly require this for external sources. The GDPR does.
Features that make the difference
- A reporting page with no IP logging, no external resources and no tracking (confidentiality and identity protection).
- Metadata stripped from attachments before they are saved.
- Case number and PIN: a conversation with no account and no email address.
- End-to-end encryption with the organisation's key; emergency access requires two parties.
- Own domain and brand: the source sees the address of the organisation it trusts (deployment and channels).
- Multiple forms: one for external sources and one for the foundation's staff, with separated permissions.
Frequently asked questions
Is a person from outside the organisation who reports to the foundation a whistleblower?
Not in relation to the foundation within the meaning of the Act, because there is no work-related context with it. They may be a whistleblower in relation to their own employer and benefit from protection on public disclosure if they meet the conditions of Article 51. The foundation is responsible for their data as controller.
Can the system vendor be compelled to hand over the content of reports?
It can receive a demand, but it hands over what it has. In end-to-end mode it has ciphertext and metadata without content or identity, and the decision to decrypt rests solely with the organisation that holds the key.
More on channels in the article Reporting channels: written, oral, in a meeting.
A procedure is a document. A channel is the system that carries it out.
sygnadesk counts the deadlines, keeps the register and protects the reporter’s identity the way the knowledge base describes. See how it would look in your organisation.